EUVD-2026-72811
GHSA-7556-4q8c-55vc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Any authenticated low-privilege account suffices; deserialization requires no special conditions (AC:L) and yields full server control (C:H/I:H/A:H).
Primary rating from Vendor (ivanti).
CVSS VectorVendor: ivanti
Lifecycle Timeline
2DescriptionCVE.org
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
AnalysisAI
Remote code execution in Ivanti Neurons for ITSM allows a low-privileged authenticated attacker to execute arbitrary code on the server by exploiting unsafe deserialization of attacker-controlled data. All versions prior to 2026.2 are affected, per CPE cpe:2.3:a:ivanti:neurons_for_itsm:*:*:*:*:*:*:*:*. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid low-privileged account on Ivanti Neurons for ITSM - any authenticated user (helpdesk agent, end-user portal account, or service account) qualifies (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) communicates a high-priority issue: the attack requires only a low-privileged account and no special conditions, making it broadly exploitable across any authenticated ITSM user population. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Ivanti Neurons for ITSM to version 2026.2 or later as directed by the Ivanti security advisory (https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-Multiple-CVEs). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, complete an inventory of Ivanti Neurons for ITSM deployments to identify all instances running versions prior to 2026.2, then immediately restrict low-privileged user permissions to read-only access on non-sensitive data elements only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Neurons For Itsm
View allAn authentication bypass in Ivanti Neurons for ITSM (on-prem only) before 2023.4, 2024.2 and 2024.3 with the May 2025 Se
Remote code execution in Ivanti Neurons for ITSM versions before 2026.2 allows a low-privileged authenticated attacker t
Remote code execution in Ivanti Neurons for ITSM prior to version 2026.2 allows a remote, unauthenticated attacker to ru
Remote code execution in Ivanti Neurons for ITSM before version 2026.2 lets an unauthenticated attacker run arbitrary co
An information disclosure vulnerability in Ivanti ITSM on-prem and Neurons for ITSM versions 2023.4 and earlier allows a
Remote code execution in Ivanti Neurons for ITSM before version 2026.2 is achievable by any authenticated remote attacke
A SQL injection vulnerability in web component of Ivanti Neurons for ITSM allows a remote authenticated user to read/mod
Improper certificate validation in Ivanti ITSM on-prem and Neurons for ITSM Versions 2023.4 and earlier allows a remote
An unrestricted file upload vulnerability in web component of Ivanti Neurons for ITSM allows a remote, authenticated, hi
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today